For an enterprise migrating from traditional Internet IPSec L2L VPNs for branch offices to a MPLS-based VPN, there are options for either a L2VPN or L3VPN. The L2VPN looks more attractive as you have nearly complete control over it to run your own routing protocols that don't require ISP coordination or MP-BGP in their network to support the VRF routing.
- If a MPLS-VPN (L3VPN) is used, DIA can be provided on that same service, though I have no direct experience with this and am not sure if it's generally a good or bad idea.
- Also, I don't think DIA is generally provided as a service or possible with L2VPN, but please confirm.
- WAAS will also be used in the future if that has any influence on whether to go L2 or L3VPN. Each branch office currently has their own DIA and will continue to have that provided either separately or multiplexed with the VPN. WAAS would be done in 2900 ISRs in the branch office and TBD in main corporate office.
- Should encryption -- not PCI/not HIPPA required -- be mandatory as we do now with IPSec or is there usually enough inherent trust with either the L2 or L3VPN implementations with VRFs; specifically, does SOX say anything about requiring encryption?
- (Bonus points) Terminating the VPN on a router inside the firewall seems to be the way to go, though with DIA multiplexed on the VPN seems to thrown a monkey-wrench into this as DIA is usually outside the firewall. With or without DIA to worry about, having the VPN on the Internet edge router outside the firewall would usually deal with public IP space, so to continue using private addressing between sites, is it recommended to just to do no-NAT or identity-NAT at the firewall.